COPENHAGEN, DENMARK / RankWire.AI / – A significant security breach involving Denmark’s Central Person Register has prompted an investigation by Danish authorities. About 8.8 million individuals’ personal data, including names, addresses, CPR numbers, and related records, was compromised by unauthorized parties. Officials confirmed that the attackers exploited a private Danish company’s lawful access to the CPR system for their searches. In response, the CPR administration has revoked the company’s access while investigations are underway to determine how the breach occurred.
Irregular activity was detected by the CPR administration on the evening of Oct. 2 after unusual searches had been observed during September. Over the weekend, authorities analyzed the activity and verified the extent of the unauthorized access. The Central Person Register contains roughly 11 million records, which include information on current residents, individuals who have moved abroad, and deceased persons. Officials clarified that the searches remained within the types of data that private companies are permitted to access through authorized CPR services.
The identity of the individual or group responsible for the activity remains unknown. Danish officials also have not disclosed the private company whose legitimate access was exploited by the attackers. The CPR administration informed Datatilsynet, Denmark’s data protection authority, about the incident, and police are conducting investigations alongside other relevant agencies. The government stated that its review found no exposure of names and addresses belonging to individuals protected under Denmark’s name and address protection scheme.
Regulatory body scrutinizes automated search activity within CPR system
Datatilsynet announced it received the incident report from the CPR register on Oct. 4. The regulator noted that the case involved a very high volume of automated searches against the CPR system. These searches aimed to verify the validity of CPR numbers, as indicated in the notification. The authority is now investigating the circumstances leading to the breach, how access was made possible, and who is responsible for processing the personal data involved. It also pledged to share additional information once there is a sufficient basis to do so.
Research, Education and Digitalisation Minister Christina Egelund described the incident as profoundly serious and briefed Denmark’s Business and Digital Affairs Committee in parliament. She also mandated a comprehensive security review of the CPR system. The Danish government has initiated measures to prevent similar incidents in the future, while the CPR administration continues to trace the sequence of events. Authorities noted that the investigation is still in its early stages and that technical reviews may refine the confirmed details.
Public advised to stay vigilant against fraud threats
Danish officials urged residents to be cautious about potential scams via phone calls, emails, or other messages that could utilize exposed personal information. They emphasized that individuals should never disclose passwords or other confidential data just because someone claiming to know their name, address, or CPR number contacts them. The government directed people to official digital security resources and Denmark’s cyber hotline. The warning came after confirmation that the unauthorized activity involved data belonging to millions of registered citizens in the national population database.
Authorities are continuing to evaluate the breach’s access pathway, the specific records affected, and the safeguards around private-sector use of the CPR system. Separately, Datatilsynet is reviewing the data protection issues raised by the incident. The CPR administration has disabled the company’s access and implemented security measures, while officials conduct a broader review of the registry. As of Oct. 7, authorities had not publicly identified the attackers, named the private company involved, or disclosed the method used to misuse its authorized access.